Serial No. 09/992,899 
IN THE CLAIMS: 



Art Unit: 2157 



Please amend the claims to read as indicated herein. 

1. (Currently amended) A method of classifying data traffic in a packet-based 
communications network conveying different classes of data, including the steps of: 

(a) monitoring a communications network for data traffic to identify a sequence of 
data packets of unknown class transmitted between a source address and a destination 
address; 

(b) measuring at l east ono param e t e r a plurality of parameters of at least a 
significant part of the packet sequence, said parameter boina anv on e o f pluralitv of 
parameters including at least two parameters selected from the group consisting of : 

- coding attributes of packets in the sequence; 

- type of transport protocol used; 

- type of error protection protocol used; 

- duration of said sequence; and 

- correlation between traffic in said sequence and traffic in a further sequence being 
transported from said destination address back to said source address; 

and 

(c) deriving from the measured param e t e ro luralitv of parameters a probable 
classification of the data conveyed in the packet sequence. 

2. (Original) A method as claimed in claim 1 where the classification is between 
real-time data traffic and other data in the network. 

3. (Original) A method as claimed in claim 2 wherein the classification 
distinguishes between voice traffic and other traffic. 

4. (Original) A method as claimed in claim 1 wherein the classification 
distinguishes between video traffic and other traffic. 
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5. (Original) A method as claimed in claim 1 where in step (b) a plurality of 
different parameters are measured. 

6. (Original) A method as claimed in claim 1 where in step (c) said classification 
is determined by a combination of processes based on different parameters, the results 
of each process being combined with the others in accordance with a specific weighting. 

7. (Currently amended) A method as claimed in claim 1 wherejn the measured 
param e ter is pluralitv of parameters includes the duration of said sequence, and 
sequences of longer duration are taken to indicate a high probability of real-time traffic. 

8. (Currently amended) A method as claimed in claim 1 wherein the measured 
parameter i s pluralitv of parameters includes a correlation between traffic in said 
sequence and traffic in a further sequence being transported from said destination 
address back to said source address, and correlation of periods of activity in one 
direction with periods of inactivity in the reverse direction is taken as an indicator of 
voice or videoconference traffic. 

9. (Currently amended) A method as claimed in claim 1 wherein a the plurality of 
parameters are measured, including timing parameters of individual packets within the 
sequence. 

10. (Currently amended) A method as claimed in claim 9 where statistical 
analysis of the plurality of parameters is used to determine said classification. 

1 1 . (Currently amended) A method as claimed in claim 1 wherein a the plurality of 
parameters are measured, including timing parameters of events in the sequence. 

12. (Original) A method as claimed in claim 11 wherein step (c) includes (i) 
deriving from the measured timing parameters one or more statistical properties of 
packet timing during at least a part of the sequence; and (ii) using said statistical 
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properties to determine said classification. 

13. (Original) A method as claimed in claim 12 where said events comprise the 
arrival of each new packet for the sequence under investigation. 

14. (Currently amended) A method as claimed in claim 1 1 wherein the measured 
plurality of parameters include the intervals between events within said sequence. 

15. (Original) A method as claimed in claim 14 wherein the uniformity of said 
intervals over a significant part of the sequence is taken to indicate a high probability of 
real-time traffic. 

16. (Original) A method as claimed in claim 15 wherein the intervals have a 
maximum duration of 20ms. 

17. (Original) A method as claimed in claim 12 wherein the step (c)(i) includes 
filtering events to restrict the events whose measured parameters are included in the 
derivation of said statistical properties. 

18. (Original) A method as claimed in claim 17 wherein said filtering is performed 
so as to eliminate periods of inactivity from consideration in deriving said statistical 
properties. 

19. (Original) A method as claimed in claim 1 wherein said sequence is divided 
for analysis into a sequence of shorter measurement periods, and filtering is performed 
by reference to measurements from one measurement period at a time. 

20. (Original) A method as claimed in claim 19 wherein said period is typically 
100ms. 

21. (Original) A method as claimed in claim 19 wherein the filtering operates to 
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omit or delete certain measurements from derivation of statistical properties of the 
measurements, or modifies those measurements and/or the statistical properties in 
some predetermined way. 

22. (Original) A method as claimed in claim 19 wherein only measurement 
periods preceded by periods containing significant activity are included in subsequent 
analysis. 

23. (Original) A method as claimed in claim 19 wherein the first measurement 
within each measurement period is discarded to eliminate bias in the measurements 
made. 

24. (Original) A method as claimed in claim 19 wherein a separate record of the 
first measurement within each measurement period is kept which is later removed from 
a population for that measurement period. 

25. (Original) A method as claimed in claim 1 wherein the amount of raw data 
obtained by monitoring network traffic is reduced by aggregating data for separate 
measurement periods, and optionally for groups of measurement periods. 

26. (Original) A method as claimed in claim 1 including steps to compensate for 
variations in the packet arrival or other event times caused by outside influences and to 
accommodate specific traffic patterns, such as when the absence of a signal can lead to 
a misinterpretation of the data. 

27. (Original) A method as claimed in claim 26 wherein errors due to the inter- 
packet arrival time are normalised against an expected arrival time. 

28. (Original) A method as claimed in claim 27 wherein an internal time reference 
is compared with arriving data packets so as to measure differences between actual 
arrival times and predicted arrival times. 
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29. (Original) A method as claimed in claim 1 wherein said measurement 
includes further measurements of correlation between parameters of traffic in opposite 
directions of a duplex connection. 

30. (Original) A method as claimed in claim 29 where correlation between 
periods of high traffic in one direction and low traffic in the other are used as an 
indicator of voice traffic. 

31. (Original) A method as claimed in claim 1 wherein additional measurements 
are used to distinguish multiple from single voice circuits and, where a connection is 
carrying multiple voice circuits, to take account of the particular attributes of such a 
connection. 

32. (Original) A method as claimed in claim 1 wherein timestamping of captured 
and re-assembled data packets is carried out on closure of the bit stream representing a 
data packet and written contiguous with the packet. 

33. (Original) A method as claimed in claim 1 wherein the process of 
timestamping packets is carried out separately from the detection and assembling of 
data packets. 

34. (Original) A method as claimed in claim 1 wherein the determined 
classification is used to automatically control configuration of the network. 

35. (Original) A method as claimed in claim 1 further comprising using the 
determined classification to report usage of the network for accounting purposes. 

36. (Currently amended) Apparatus for classifying data traffic in a packet-based 
communications network conveying different classes of data, comprising: 

(a) monitoring means for monitoring a communications network for data traffic to 
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identify a sequence of data packets of unknown class transmitted between a source 
address and a destination address; 

(b) measuring means for measuring at l o ast on e param e t e r a plurality of 
parameters of at least a significant part of the packet sequence, said param e t e r being 
any on e o f pluralitv of parameters including at least two parameters selected from the 
group consisting of : 

- coding attributes of packets in the sequence; 

- type of transport protocol used; 

- type of error protection protocol used; 

- duration of said sequence; and 

- correlation between traffic in said sequence and traffic in a further sequence being 
transported from said destination address back to said source address; 

and 

(c) classification means for deriving from the measured param e t e r pluralitv of 
parameters a probable classification of the data conveyed in the packet sequence. 
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